AUTHENTICATING A PROCESSING SYSTEM ACCESSING A RESOURCE

• US 20090204972A1
• Filed: 02/12/2008
• Published: 08/13/2009
• Est. Priority Date: 02/12/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Brice, Frank William JR., Chambliss, David Darden, Yudenfriend, Harry Morris, Kalos, Matthew Joseph
• Granted Patent: US 8,230,435 B2
• Time in Patent Office: Days
• US Class Current: 718/104
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0683 Plurality of storage devices
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: G06F 9/5005 to service a request

Abstract

Provided are a method, system, and article of manufacture for authenticating a processing system accessing a resource. An association of processing system identifiers with resources, including a first and second resources, is maintained. A request from a requesting processing system in a host is received for use of a first resource that provides access to a second resource, wherein the request is generated by processing system software and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host. A determination is made as to whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources. The requesting processing system is provided access to the first resource that the processing system uses to access the second resource.

Claims

1. A method, comprising:

maintaining an association of processing system identifiers with resources, including a first and second resources;

receiving a request from a requesting processing system in a host for use of a first resource that provides access to a second resource, wherein the request is generated by processing system software and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host;

determining whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources; and

providing the requesting processing system access to the first resource that the processing system uses to access the second resource.

2. The method of claim 1, wherein the processing system software comprises a processing system operating system, wherein the processing system operating system cannot modify the submitted processing system identifier included by the host hardware.

3. The method of claim 1, wherein the received request is associated with a submitted path group identifier provided by the requesting processing system software, further comprising:

maintaining an association of path group identifiers with resources, wherein the path group identifiers, identifying path groups, are associated with resources such that processing systems associated with one path group identifier are provided access to the resources associated with that path group identifier over paths included in the path group; and

determining whether the path group identifier associated with the request matches the path group identifier associated with the first and second resources, wherein the determination of whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources is performed in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested first and second resources.

4. The method of claim 3, further comprising:

for each path group identifier, indicating a processing system identifier identifying the processing system assigned to the path group identified by the path group identifier.

5. The method of claim 4, further comprising:

providing a control block for each path group identifier indicating the associated resources and processing system identifier associated with the path group identifier;

providing, to the processing system assigned to one path group, an index to an entry in a table for the path group identifier to which the processing system is assigned, wherein the processing system software includes a pointer in the submitted request for the resource to provide access to the entry in the table for the path group identifier included in the request.

6. The method of claim 1, wherein the second resource comprises a base address of a volume, wherein the first request comprises an alias address to use to access the base address, wherein the request is associated with a path group identifier identifying a path group, wherein base and alias addresses are associated with path group identifiers such that the processing system associated with one path group identifier is provided access to the base volumes associated with that path group identifier, further comprising:

for each path group identifier, maintaining an association of the path group identifier, base addresses of volumes and alias addresses, and a processing system identifier of a processing system assigned to the path group identified by the path group identifier; and

determining whether the path group identifier associated with the request matches the path group identifier associated with the base and alias address in the request, wherein the determination of whether the submitted processing system identifier matches the processing system identifier associated with the path group identifier is performed in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested base and alias addresses.

7. The method of claim 6, wherein the processing system identifier identifies a logical partition in the host from which the request originated, further comprising:

for each path group identifier, associating a host identifier of a host including the logical partition assigned to the path group identified by the path group identifier;

determining whether the base address and the alias address included in the request are associated with different hosts; and

determining whether the host identifier of the host including the logical partition submitting the request matches the host identifier associated with the path group identifier associated with the request in response to determining that the base and alias addresses in the submitted request are associated with different hosts, wherein the request to use the alias address to access the base address indicated in the request is granted in response to determining that the host identifier of the host matches the host identifier associated with the path group identifier associated with the request when the base and alias addressed indicated in the request are associated with different hosts.

8. The method of claim 7 wherein the host identifier is included in the submitted request by the host hardware.

9. A system in communication with processing systems in a host, wherein each processing system includes processing system software, comprising:

a computer readable medium including an association of processing system identifiers with resources, including a first and second resources;

an Input/Output (“

I/O”

) manager to perform operations, the operations comprising;

receiving a request from a requesting one of the processing systems in the host for use of a first resource that provides access to a second resource, wherein the request is generated by the processing system software in the request processing system and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host;

determining whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources; and

providing the requesting processing system access to the first resource that the processing system uses to access the second resource.

10. The system of claim 9, wherein the processing system software comprises a processing system operating system, wherein the processing system operating system cannot modify the submitted processing system identifier included by the host hardware.

11. The system of claim 9, wherein the received request is associated with a submitted path group identifier provided by the requesting processing system software, wherein the I/O manager operations further comprise:

maintaining an association of path group identifiers with resources, wherein the path group identifiers, identifying path groups, are associated with resources such that processing systems associated with one path group identifier are provided access to the resources associated with that path group identifier over paths included in the path group; and

determining whether the path group identifier associated with the request matches the path group identifier associated with the first and second resources, wherein the determination of whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources is performed in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested first and second resources.

12. The system of claim 11, wherein the I/O manager operations further comprise:

for each path group identifier, indicating a processing system identifier identifying the processing system assigned to the path group identified by the path group identifier.

13. The system of claim 9, wherein the second resource comprises a base address of a volume, wherein the first request comprises an alias address to use to access the base address, wherein the request is associated with a path group identifier identifying a path group, wherein base and alias addresses are associated with path group identifiers such that the processing system associated with one path group identifier is provided access to the base volumes associated with that path group identifier, wherein the I/O manager operations further comprise:

for each path group identifier, maintaining an association of the path group identifier, base addresses of volumes and alias addresses, and a processing system identifier of a processing system assigned to the path group identified by the path group identifier; and

determining whether the path group identifier associated with the request matches the path group identifier associated with the base and alias address in the request, wherein the determination of whether the submitted processing system identifier matches the processing system identifier associated with the path group identifier is performed in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested base and alias addresses.

14. The system of claim 13, wherein the processing system identifier identifies a logical partition in the host from which the request originated, wherein the I/O manager operations further comprise:

for each path group identifier, associating a host identifier of a host including the logical partition assigned to the path group identified by the path group identifier;

determining whether the base address and the alias address included in the request are associated with different hosts; and

determining whether the host identifier of the host including the logical partition submitting the request matches the host identifier associated with the path group identifier associated with the request in response to determining that the base and alias addresses in the submitted request are associated with different hosts, wherein the request to use the alias address to access the base address indicated in the request is granted in response to determining that the host identifier of the host matches the host identifier associated with the path group identifier associated with the request when the base and alias addressed indicated in the request are associated with different hosts.

15. An article of manufacture implementing an Input/Output (I/O) manager in communication with processing systems in a host, wherein each processing system includes processing system software, wherein the I/O manager causes operations to be performed, the operations comprising:

maintaining an association of processing system identifiers with resources, including a first and second resources;

receiving a request from a requesting one of the processing systems for use of a first resource that provides access to a second resource, wherein the request is generated by processing system software and wherein the request further includes a submitted processing system identifier included in the request by host hardware in the host;

determining whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources; and

providing the requesting processing system access to the first resource that the processing system uses to access the second resource.

16. The article of manufacture of claim 15, wherein the processing system software comprises a processing system operating system, wherein the processing system operating system cannot modify the submitted processing system identifier included by the host hardware.

17. The article of manufacture of claim 15, wherein the received request is associated with a submitted path group identifier provided by the requesting processing system software, wherein the operations further comprise:

maintaining an association of path group identifiers with resources, wherein the path group identifiers, identifying path groups, are associated with resources such that processing systems associated with one path group identifier are provided access to the resources associated with that path group identifier over paths included in the path group; and

determining whether the path group identifier associated with the request matches the path group identifier associated with the first and second resources, wherein the determination of whether the submitted processing system identifier is one of the processing system identifiers associated with the first and second resources is performed in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested first and second resources.

18. The article of manufacture of claim 17, wherein the operations further comprise:

for each path group identifier, indicating a processing system identifier identifying the processing system assigned to the path group identified by the path group identifier.

19. The article of manufacture of claim 15, wherein the second resource comprises a base address of a volume, wherein the first request comprises an alias address to use to access the base address, wherein the request is associated with a path group identifier identifying a path group, wherein base and alias addresses are associated with path group identifiers such that the processing system associated with one path group identifier is provided access to the base volumes associated with that path group identifier, wherein the operations further comprise:

for each path group identifier, maintaining an association of the path group identifier, base addresses of volumes and alias addresses, and a processing system identifier of a processing system assigned to the path group identified by the path group identifier; and

determining whether the path group identifier associated with the request matches the path group identifier associated with the base and alias address in the request, wherein the determination of whether the submitted processing system identifier matches the processing system identifier associated with the path group identifier is performed in response to determining that the path group identifier associated with the request matches the path group identifier associated with the requested base and alias addresses.

20. The article of manufacture of claim 19, wherein the processing system identifier identifies a logical partition in the host from which the request originated, wherein the operations further comprise:

for each path group identifier, associating a host identifier of a host including the logical partition assigned to the path group identified by the path group identifier;

determining whether the base address and the alias address included in the request are associated with different hosts; and

determining whether the host identifier of the host including the logical partition submitting the request matches the host identifier associated with the path group identifier associated with the request in response to determining that the base and alias addresses in the submitted request are associated with different hosts, wherein the request to use the alias address to access the base address indicated in the request is granted in response to determining that the host identifier of the host matches the host identifier associated with the path group identifier associated with the request when the base and alias addressed indicated in the request are associated with different hosts.